Privacy Policy
Version v1.1.0 · Last updated: 4 September 2026
This privacy policy explains how Legit AI Oy processes personal data on the Haavi website (www.haavi.ai) and in the Haavi app (app.haavi.ai).
We comply with the requirements of the EU General Data Protection Regulation (GDPR) in processing personal data. This policy covers website use, the contact and registration forms, the website AI assistant, and use of the Haavi app.
By using our website or our app, you agree that we process your data as described in this policy.
Data controller contact information
The data controller (the party responsible for processing your personal data) is Legit AI Oy, which operates the Haavi website and the Haavi app.
Legit AI Oy, business ID 3415277-4. Address: Fleminginkatu 10 A 1, 00530 Helsinki, Finland.
Contact person: Aku Nikkola. Email: aku@haavi.ai. Phone: +358 40 571 2966. You can send all privacy-related inquiries and requests to the above email address.
Personal data we collect
We collect the following personal data. Some of it is collected only on the website and some only in the Haavi app.
- Name and contact details: name, email address, phone number and job title.
- Company information: name, business ID, website, description, industry, revenue and number of employees.
- User account details and login credentials (Haavi app).
- Information you submit through forms: the contact and registration forms and the newsletter subscription.
- Conversations with the website AI assistant, and the name, email address and company name you give the assistant.
- Procurement material you process in the app: tender documents, bid history, qualifications and references.
- Technical data: IP address, browser information, and usage and log data.
Purposes of processing
We process personal data only for predefined purposes.
- Service provision and user account management: We process your data to provide the service, maintain user accounts, and offer customer support.
- Handling enquiries and registrations: We process the data you give through our forms and the AI assistant in order to respond to you.
- Communication and information: We use contact information to communicate with you about service-related matters. We request separate consent for marketing messages and the newsletter.
- Website and app development and analytics: Technical data and cookie-collected data are used to monitor and improve service usage.
- Security and abuse prevention: Personal data may be processed to secure the website, the app and user information.
- Legal obligations: We process personal data to fulfil our statutory obligations.
Legal bases for processing
We process personal data on the following legal bases under the GDPR.
- Performance of a contract: maintaining your user account and providing the service to you or the organisation you represent.
- Consent: marketing communications, the newsletter subscription and analytics cookies.
- Legitimate interest: responding to enquiries, service development, security and abuse prevention.
- Legal obligation: accounting legislation and other statutory obligations that bind us.
Personal data retention periods
We retain personal data only as long as necessary to fulfil the described purposes or as required by law.
- User account data is retained as long as you have an active user account. After account deletion, data is deleted or anonymised within 30 days.
- Enquiry, registration and assistant conversation data is retained as long as it is needed to handle your enquiry and to prepare a possible customer relationship. We delete the data once the matter is handled and no customer relationship is formed.
- Newsletter subscriber data is retained until you unsubscribe.
- Website analytics data is collected in aggregate form and cannot identify an individual user.
- Accounting-related data is retained for up to 6 years in accordance with accounting legislation.
- You can delete your user account and the data related to it yourself at any time in the Haavi app settings. You can also request deletion by contacting us.
Personal data protection
The security of your personal data is important to us. We use appropriate technical and organisational measures to prevent unauthorised access to data.
All connections are encrypted with TLS and data is also encrypted at rest. Other measures include firewalls, secure server connections, access control and regular security audits.
Only personnel who need access for their duties can process personal data, and they are bound by confidentiality obligations.
Personal data sharing and transfers
We do not sell, rent, or otherwise disclose your personal data to external third parties for marketing purposes. We share personal data with external parties only in the following situations:
- Service provision: we use the service providers listed below, who process personal data on our behalf.
- Legal obligations: We may disclose personal data to authorities when required by law.
- Corporate transactions: If our business is sold or merged, data may be transferred as part of the transaction.
Third-party service providers
We use the following service providers, who process personal data on our behalf:
| Service provider | Purpose | Data processed | Location | Transfer mechanism |
|---|---|---|---|---|
| Supabase | Database, user management, and storage of form and enquiry data | All user and company data, form data | EU | Data stays within the EU |
| Vercel | Website and app hosting, and website usage analytics | IP address, usage data | EU | Data stays within the EU |
| Amazon Web Services (Bedrock) | AI processing in the Haavi app | User inputs, conversation history, company information, procurement material | EU | Data stays within the EU |
| Upstash | Rate limiting to protect the service | User identifier (stored temporarily, deleted within minutes) | EU | Data stays within the EU |
| Lettermint | Email messages from the Haavi app, and website enquiry and registration notifications | Name, email address, company name, message content | EU | Data stays within the EU |
| Sentry | Error tracking and technical monitoring | IP address, error logs, technical data | EU | Data stays within the EU |
| Anthropic (Claude) | Website AI assistant, and app failover when EU capacity is unavailable | User inputs and conversation history | USA | SCCs + EU-US Data Privacy Framework |
| Stripe | Payment processing | Name, email, payment details | USA | SCCs + EU-US Data Privacy Framework |
| Slack | Slack integration, when you enable it | Message content, Slack user and workspace identifiers | USA | SCCs + EU-US Data Privacy Framework |
| Microsoft | Single sign-on (Microsoft Entra ID) | Name, email address, profile identifiers | USA | SCCs + EU-US Data Privacy Framework |
| Single sign-on (Google) | Name, email address, profile identifiers | USA | SCCs + EU-US Data Privacy Framework |
International data transfers
Personal data is transferred to the United States by the service providers marked USA in the table above: Anthropic, Stripe, Slack, Microsoft and Google.
Transfers are protected by EU Standard Contractual Clauses (SCCs) and/or EU-US Data Privacy Framework certification. You can request a copy of the Standard Contractual Clauses by contacting aku@haavi.ai.
Use of cookies
We use cookies and similar technologies. A cookie is a small text file that your browser stores. We use the following cookies:
- Necessary cookies: they manage login and your session in the Haavi app, and access to protected pages. The service does not work without them.
- Functional cookies: they store your language choice for one year.
- Usage analytics: we collect information about website usage for service development. We enable analytics only after you have accepted it in the cookie banner.
- Security cookies: they protect the connection to an external service, for example Slack. The service deletes them after use.
Managing cookies
You can accept or decline analytics cookies in the cookie banner shown on the website. Your choice is stored in your browser, and you can change it by clearing your browser data.
You can also delete or block cookies in your browser settings. If you block necessary cookies, you cannot log in to the Haavi app.
User rights
As a user, you have privacy rights that allow you to influence the processing of your personal data. We provide all GDPR-compliant rights:
- Right of access: The right to confirm whether we process your personal data and to request a copy of your data.
- Right to rectification: The right to request correction of inaccurate or incomplete data.
- Right to erasure: The right to request deletion of your personal data in certain circumstances.
- Right to restriction: The right to request restriction of processing in certain circumstances.
- Right to object: The right to object to processing based on your particular personal situation.
- Right to data portability: The right to receive your data in a structured, machine-readable format.
- Right to withdraw consent: The right to withdraw your consent at any time.
- Right to lodge a complaint: The right to file a complaint with the Data Protection Ombudsman's Office.
Privacy policy changes and updates
We may periodically update this privacy policy to reflect changing practices, legislation, or service features.
Every version has a version number, and the date at the top of this page shows the last update. If we make material changes, we will notify users and ask Haavi app users for their consent again.
Contact us
If you have any questions about this privacy policy, Haavi's security, or other Haavi-related matters, please don't hesitate to contact us:
Aku Nikkola, Founder – aku@haavi.ai